Clear invalid field maps in PropertyAccessInfo.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 5475 matching lines @@
     if (!info->access_.representation().IsCompatibleForLoad(r)) return false;
   } else {
     if (!info->access_.representation().IsCompatibleForStore(r)) return false;
   }
   if (info->access_.offset() != access_.offset()) return false;
   if (info->access_.IsInobject() != access_.IsInobject()) return false;
   if (!field_map_.is_identical_to(info->field_map_)) {
     if (!IsLoad()) return false;
 
     // Throw away type information for merging polymorphic loads.
-    field_map_ = info->field_map_ = Handle<Map>();
+    info->field_map_ = Handle<Map>::null();
   }
   info->GeneralizeRepresentation(r);
   return true;
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupDescriptor() {
   if (!type_->IsClass()) return true;
   map()->LookupDescriptor(NULL, *name_, &lookup_);
   return LoadResult(map());
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::LoadResult(Handle<Map> map) {
   if (!IsLoad() && lookup_.IsProperty() &&
       (lookup_.IsReadOnly() || !lookup_.IsCacheable())) {
     return false;
   }
 
   if (lookup_.IsField()) {
     // Construct the object field access.
     access_ = HObjectAccess::ForField(map, &lookup_, name_);
 
     // Load field map for heap objects.
-    if (access_.representation().IsHeapObject()) LoadFieldMap(map);
+    LoadFieldMap(map);
   } else if (lookup_.IsPropertyCallbacks()) {
     Handle<Object> callback(lookup_.GetValueFromMap(*map), isolate());
     if (!callback->IsAccessorPair()) return false;
     Object* raw_accessor = IsLoad()
         ? Handle<AccessorPair>::cast(callback)->getter()
         : Handle<AccessorPair>::cast(callback)->setter();
     if (!raw_accessor->IsJSFunction()) return false;
     Handle<JSFunction> accessor = handle(JSFunction::cast(raw_accessor));
     if (accessor->shared()->IsApiFunction()) {
       CallOptimization call_optimization(accessor);
       if (call_optimization.is_simple_api_call()) {
         CallOptimization::HolderLookup holder_lookup;
         Handle<Map> receiver_map = this->map();
         api_holder_ = call_optimization.LookupHolderOfExpectedType(
             receiver_map, &holder_lookup);
       }
     }
     accessor_ = accessor;
   } else if (lookup_.IsConstant()) {
     constant_ = handle(lookup_.GetConstantFromMap(*map), isolate());
   }
 
   return true;
 }
 
 
 void HOptimizedGraphBuilder::PropertyAccessInfo::LoadFieldMap(Handle<Map> map) {
+  // Clear any previous field map.
+  field_map_ = Handle<Map>::null();
+
   // Figure out the field type from the accessor map.
   HeapType* field_type = lookup_.GetFieldTypeFromMap(*map);
   if (field_type->IsClass()) {
+    ASSERT(access_.representation().IsHeapObject());
     Handle<Map> field_map = field_type->AsClass();
     if (field_map->is_stable()) {
       field_map_ = field_map;
       Map::AddDependentCompilationInfo(
           field_map_, DependentCode::kPrototypeCheckGroup, top_info());
 
       // Add dependency on the map that introduced the field.
       Map::AddDependentCompilationInfo(
           handle(lookup_.GetFieldOwnerFromMap(*map), isolate()),
           DependentCode::kFieldTypeGroup, top_info());
@@ skipping 35 matching lines @@
   if (IsLoad()) return true;
 
   if (lookup_.IsPropertyCallbacks()) return true;
   Handle<Map> map = this->map();
   map->LookupTransition(NULL, *name_, &lookup_);
   if (lookup_.IsTransitionToField() && map->unused_property_fields() > 0) {
     // Construct the object field access.
     access_ = HObjectAccess::ForField(map, &lookup_, name_);
 
     // Load field map for heap objects.
-    if (access_.representation().IsHeapObject()) LoadFieldMap(transition());
+    LoadFieldMap(transition());
     return true;
   }
   return false;
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessAsMonomorphic(
     SmallMapList* types) {
   ASSERT(type_->Is(ToType(types->first())));
   if (!CanAccessMonomorphic()) return false;
@@ skipping 5983 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal